Importing records into a context table
POST /api/v1/kuma/contextTables/import
The target correlator must be running.
Access: General administrator, Tenant administrator, Tier 2 analyst, Tier 1 analyst.
Query parameters (URL Query)
Name | Data type | Mandatory | Description | Value example |
correlatorID | string | Yes | Correlator service ID | 00000000-0000-0000-0000-000000000000 |
contextTableID | string | If contextTableName is not specified | Context table ID | 00000000-0000-0000-0000-000000000000 |
contextTableName | string | If contextTableID is not specified | Name of the context table | Attackers |
format | string | Yes | Format of imported entries | CSV, TSV, internal |
clear | bool | No | Clear the context table before importing. If the parameter is present in the URL query, its value is assumed to be true. The values specified by the user are ignored. | /api/v1/contextTables/import?clear |
Request body
Format | Contents |
CSV | The first row is the header, which lists the comma-separated fields. The rest of the rows are the comma-separated values corresponding to the fields in the header. The number of fields in each row must be the same, and it must match the number of fields in the schema of the context table. List field values are separated by the "|" character. For example, the value of a list of integers might be 1|2|3. |
TSV | The first row is the header, which lists the TAB-separated fields. The rest of the rows are the TAB-separated values corresponding to the fields in the header. The number of fields in each row must be the same, and it must match the number of fields in the schema of the context table. List field values are separated by the "|" character. |
internal | Each line contains one individual JSON object. Data in the 'internal' format can be obtained by exporting the contents of the context table from the correlator in the KUMA web console. |
Response
HTTP code: 204
Possible errors
HTTP code | Description |
|
|
|---|---|---|---|
400 | Correlator service ID is not specified. | query parameter required | correlatorID |
400 | Neither the contextTableID parameter nor the contextTableName parameter is specified. | one of query parameters required | contextTableID, contextTableName |
400 | The 'format' parameter is not specified. | query parameter required | format |
400 | The 'format' parameter is invalid. | invalid query parameter value | format |
400 | The request body has zero length. | request body required | - |
400 | Error parsing the request body, including the non-conformance of the field names and types of the record being imported with the schema of the context table. | correlator API request failed | variable |
403 | The user does not have the required role in the correlator tenant. | access denied | - |
404 | The service with the specified ID (correlatorID) was not found. | service not found | - |
404 | The context table was not found. | context table not found | - |
406 | The service with the specified ID (correlatorID) is not a correlator. | service is not correlator | - |
406 | The correlator did not execute the first start. | service not paired | - |
406 | The tenant of the correlator is disabled. | tenant disabled | - |
406 | More than one context table found by a search for contextTableName. | more than one matching context tables found | - |
50x | Failed to gain access to the correlator API. | correlator API request failed | variable |
500 | Error preparing data for importing into the correlator service. | context table process import request failed | variable |
500 | Any other internal error. | variable | variable |
